Signature mechanism

Overview

For RPC API requests, you must add a signature to the query string in the following format.

https://Endpoint/?SignatureVersion=1.0&SignatureMethod=HMAC-SHA1&Signature=CT9X0VtwR86fNWSnsc6v8YGOjuE%3D&SignatureNonce=3ee8c1b8-83d3-44af-a94f-4e0ad82fd6cf

Signature = Base64( HMAC-SHA1( AccessSecret, UTF-8-Encoding-Of(
StringToSign)) )

Step 1: Create the string to sign

1. Create a canonicalized query string from the request parameters.

   1. Sort all request parameters in alphabetical order by parameter name. These parameters include common request parameters and API-specific parameters, but not the Signature parameter.

      Note

      If you submit a request using the GET method, these parameters are the part of the request URI that follows the question mark (?) and are separated by ampersands (&).

   2. Encode the names and values of the sorted request parameters using the UTF-8 character set. The encoding rules are described in the following table.

      Character	Encoding method
      A-Z, a-z, 0-9, and the characters "-", "_", ".", and "~"	Do not encode.
      Other characters	Encode into the %XY format. XY is the hexadecimal representation of the character's ASCII code. For example, a double quotation mark (") is encoded as %22.
      Extended UTF-8 characters	Encode into the %XY%ZA… format.
      Space	Encode as %20, not a plus sign (+). This encoding method is different from the application/x-www-form-urlencoded Multipurpose Internet Mail Extensions (MIME) format encoding algorithm, such as the implementation of java.net.URLEncoder in the Java standard library. When encoding, you can first use the standard library method. Then, replace the plus signs (+) in the encoded string with %20, asterisks (*) with %2A, and %7E with tildes (~). This produces an encoded string that follows the rules described above. This algorithm can be implemented with the following percentEncode method: private static final String ENCODING = "UTF-8"; private static String percentEncode(String value) throws UnsupportedEncodingException { return value != null ? URLEncoder.encode(value, ENCODING).replace("+", "%20").replace("*", "%2A").replace("%7E", "~") : null; }

   3. Connect each encoded parameter name to its value with an equal sign (=).

   4. Connect the parameter-value pairs with ampersands (&) in the order from Step 1.a. This generates the canonicalized query string.

2. Create the string to sign from the canonicalized query string based on the following rules.

   StringToSign=
         HTTPMethod + "&" +
         percentEncode("/") + "&" +
          percentEncode(CanonicalizedQueryString)

   Where:

   • HTTPMethod is the HTTP method that is used for the request, such as GET.

   • percentEncode("/") is the value %2F, which results from encoding the character "/" based on the URL encoding rules in Step 1.a.

   • percentEncode(CanonicalizedQueryString) is the string that is generated by encoding the canonicalized query string from Step 1. You must use the URL encoding rules that are described in Step 1.b.

Step 2: Calculate the signature value

1. Calculate the HMAC value of the string to sign (StringToSign) as defined in RFC 2104.

   Note

   The key that is used for the signature calculation is your AccessKey secret with an ampersand (&) character (ASCII code 38) appended. The hash algorithm is SHA1.

2. Encode the HMAC value in Base64 to obtain the signature string. This string is the signature value (Signature).

3. Add the generated signature value to the request parameters as the Signature parameter.

   Note

   When the signature value is submitted as the final request parameter, it must be URL-encoded in the same way as other parameters in accordance with the rules that are defined in RFC 3986.

Example

This section uses the ClassifyPOI operation as an example. The request URL before signing is as follows:

https://address-purification.cn-hangzhou.aliyuncs.com/?Action=ClassifyPOI
&SignatureVersion=1.0
&Format=xml
&Version=2019-11-18
&AccessKeyId=testid
&SignatureMethod=HMAC-SHA1
&Timestamp=2012-06-01T12:00:00Z

For example, if the AccessKey ID is `testid` and the AccessKey secret is `testsecret`, the key for calculating the HMAC is `testsecret&`.

The calculated signature is as follows:

41wk2SSX1GJh7fwnc5eqOfiJPF****

The request URL after signing is as follows:

https://address-purification.cn-hangzhou.aliyuncs.com/?Action=ClassifyPOI
&SignatureVersion=1.0
&Format=xml
&Version=2019-11-18
&AccessKeyId=testid
&SignatureMethod=HMAC-SHA1
&Timestamp=2012-06-01T12:00:00Z
&Signature=41wk2SSX1GJh7fwnc5eqOfiJPF****